Changed​

• Allow for more silent idp checks while the still anonymous

Added​

• Support for future feature matching on subdomain hashes instead of requiring glob patterns for staging servers

Changed​

• Updated the backdrop behavior to use aria-hidden by default and only apply the inert attribute when the useInertForBackdrop configuration is enabled
• preferBroadcastChannel and preventUnloadListener now default to true when no agent config is provided

Fixed​

• Fix web SDK initialization and event collection in older Internet Explorer document modes
• Resolved an issue where certain WebSocket browser extensions could cause the application to hang by disabling live replay when non-native WebSocket methods are detected
• Prevented the mobile keyboard from closing unexpectedly when tapping into guide text fields in Cordova applications

Security​

• Check the origin of frames joining the cross-frame channel when enforceAllowedOriginServers is enabled
• Reject cross-frame connect messages from windows outside the page's own frame tree
• Only read legacy window.pendo_options configuration when it is a plain object
• Only load the staging/debug agent from a script tag served by the Pendo CDN
• Anchor regular-expression entries in the allowed origin server list so a look-alike origin is no longer trusted
• Properly escape all allowed origins used in regex

Changed​

• Updated @pendo/web-sdk to 2.343.0 and @pendo/designer-agent-plugins to 3.2.55

Fixed​

• Reduced the severity of benign storage access logs in the browser extension to prevent unnecessary error banners in host applications

Added​

• Added a snapshot callback to the live flag check when starting a visitor recording in the Web SDK
• Included guide and AI agent events in live replay event logs
• Add a badge option to keep the host app's focus when a badge is clicked

Changed​

• Updated guide components to prevent double-border rendering on buttons by ensuring the component host no longer paints background or border styles

Fixed​

• Fixed an issue where embedded guides intermittently failed to render when their target elements were re-triggered quickly

Fixed​

• Reduced the severity of benign storage access logs in the browser extension to prevent unnecessary error banners in host applications

Changed​

• Update web sdk to 2.342.2

Added​

• HTML guides can now conditionally render elements based on the visitor's eligible guides, and can opt out of the step progress indicator.

Fixed​

• HTML guide themes now apply their secondary button background, border, and font color
• Guide content and image URLs now honor a content CNAME configured in app settings, not just one set in the install snippet.
• Fixed an issue where a guide backdrop could impact page performance on sites using their own inert polyfill
• Fixed inline badges not rendering when the target is a custom element inside a shadow host with named slots

Changed​

• Update web-sdk to 2.341.0

Fixed​

• Protect against empty postmessage guard lists
• Prevent post message safeguard from blocking designer launches
• Fixed an issue where session replays for extension-based applications would occasionally display a blank screen due to uncaptured style changes

Security​

• Removed development urls from public npm package's trusted domains

Fixed​

• Fixed a bug where dismissing a guide could leave the host page unresponsive to clicks until reload, in apps that reinitialize Pendo more than once without a full page reload.
• Fixed guide content URL rewrite behavior when combined with self-hosted assets.
• Fixed guide content validation requesting content files from the default host instead of the configured contentHost, blocking guides.
• Ensure that global css is tied to the specific public app id to prevent removing accidentally

Security​

• Reject cross-frame connect messages from windows outside the page's own frame tree